Wallet as a Service (WaaS)

Wallet as a Service (WaaS) is a model in which a specialist provider supplies the infrastructure for creating, securing and operating crypto wallets, and other businesses plug it into their own products through an application programming interface or a software development kit. A game, payments app, bank or online shop can then give its users wallets that hold tokens or stablecoins without building its own key management system.

WaaS is part of the wider trend of embedded finance, in which financial features are offered inside non-financial products, and it is often compared with banking-as-a-service. Providers range from large exchanges and custody firms to start-ups focused on developer tools. The key design choice is who controls the private keys: the provider, the business, the end user, or some combination.

Think of a shopping centre that wants to offer safe-deposit boxes to its visitors. Rather than building a vault, it rents space from a security company that installs the boxes, the locks and the alarm system, while the boxes carry the shopping centre's own branding. Customers deal with the shopping centre; the security firm does the hard work behind the scenes.

Wallet as a Service works the same way. An app shows users a wallet with its own name and design, but the technology that creates the keys, protects them and sends transactions belongs to the provider.

A business signs up with a provider, integrates its API or SDK and decides how wallets will be created. When a user signs up, the system generates a new wallet, often invisibly, and links it to the user's account, sometimes using only an email address or phone number as the login. The provider handles:

• Key generation and storage. Creating keys securely, often inside a hardware security module or by splitting them with multi-party computation.
• Transaction signing. Approving and broadcasting transfers according to rules the business sets, such as limits and approval steps.
• Network support. Connecting to several blockchains so the same wallet can hold assets on different networks.
• Recovery. Letting users regain access if they lose a device, without a written seed phrase in many designs.

Some products add features such as gas sponsorship, where the app pays network fees on users' behalf, or smart contract wallets built on account abstraction.

WaaS products fall along a spectrum. In a fully custodial model, the provider or the business holds the keys and can move funds, much like an exchange account. In a non-custodial model, the user holds at least one essential key share, so neither the provider nor the business can move funds alone; an MPC wallet is a common way to achieve this. Hybrid models split control, for example requiring both the user and the provider to sign. The choice affects security, user experience and, above all, regulatory status, since holding keys for others usually counts as custody.

Common uses include giving players in-game items as tokens, letting fintech apps offer stablecoin balances and cross-border stablecoin payments, enabling loyalty points or tickets as NFTs, and letting exchanges or brokers create deposit addresses at scale. For many of these businesses the attraction is that users never need to install a separate wallet app or understand keys to get started.

Whether a WaaS arrangement is regulated depends on who controls the assets and where the business operates. A company that holds or can move customers' crypto may need a licence as a virtual asset service provider, a money transmitter or a custodian, and must run know your customer checks, transaction monitoring and, where it applies, the travel rule. Truly non-custodial software is treated more lightly in many jurisdictions, but the line is not drawn the same way everywhere. Businesses using a provider still carry their own obligations; outsourcing the technology does not outsource the regulatory responsibility.

• Provider dependence. If the provider has an outage, changes its prices or shuts down, every wallet built on it is affected, and migrating users can be hard.
• Security concentration. A flaw in one provider's system could expose many businesses' users at once.
• Unclear control. Users may not understand whether they truly own their assets or whether the app can freeze or move them.
• Recovery trade-offs. Easy recovery through email or phone can make accounts vulnerable to takeover, for example through SIM swapping.